Today a colleague came to me with the question, if it is possible to download a file from Azure Storage from a Windows server.
Now this would normally be fairly simple, however:

1. We would not be allowed to use an external tool (like azcli / azcopy)
2. The server runs Windows PowerShell 4.0 (and an upgrade is not possible at this time).
3. AzureRm(.Storage) PowerShell module does not support PowerShell 4.0
4. We should be using a SAS-Token to download the files from the Azure Storage Account.

I figured that the only option we had left to approach was to use invoke-Webrequest against the Azure Rest-API.
Digging into the documentation on Microsoft Docs I found the following article: https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1

If you read closely into the documentation you can see that the SAS token aquired from the Storage Account can simply be added at the end of the requesting URI to authenticate.
Due to this nature, there is no need to add an additional header to the webrequest, making this faily simple to use.

The result is the following simple function we can now use to download files from blobs within azure from *any* windows server with access to Azure.

Function Get-AzureBlobFromAPI {
    param(
        [Parameter(Mandatory)]
        [string] $StorageAccountName,
        [Parameter(Mandatory)]
        [string] $Container,
        [Parameter(Mandatory)]
        [string] $Blob,
        [Parameter(Mandatory)]
        [string] $SASToken,
        [Parameter(Mandatory)]
        [string] $File
    )

    # documentation: https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1
    Invoke-WebRequest -Uri "https://$StorageAccountName.blob.core.windows.net/$Container/$($Blob)$($SASToken)" -OutFile $File
}